diff --git a/CHANGELOG b/CHANGELOG
index cdb45642..136e7a9a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -241,6 +241,10 @@ HISTORY
 
   ++ Bug fixes:
 
+  2007-07-13 Frédéric Bernon
+  * api_msg.c: Fix bug #20318: api_msg "recv" callbacks don't call pbuf_free in
+    all error cases.
+
   2007-07-13 Frédéric Bernon
   * api_msg.c: Fix bug #20315: possible memory leak problem if tcp_listen failed,
     because current code doesn't follow rawapi.txt documentation.
diff --git a/src/api/api_msg.c b/src/api/api_msg.c
index 0d7b31d6..0a32e425 100644
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
@@ -62,10 +62,8 @@ recv_raw(void *arg, struct raw_pcb *pcb, struct pbuf *p,
   struct netconn *conn;
 
   conn = arg;
-  if (!conn)
-    return 0;
 
-  if (conn->recvmbox != SYS_MBOX_NULL) {
+  if ((conn != NULL) && (conn->recvmbox != SYS_MBOX_NULL)) {
     if (!(buf = memp_malloc(MEMP_NETBUF))) {
       return 0;
     }
@@ -104,29 +102,27 @@ recv_udp(void *arg, struct udp_pcb *pcb, struct pbuf *p,
 
   conn = arg;
 
-  if (conn == NULL) {
+  if ((conn == NULL) || (conn->recvmbox == SYS_MBOX_NULL)) {
     pbuf_free(p);
     return;
   }
 
-  if (conn->recvmbox != SYS_MBOX_NULL) {
-    buf = memp_malloc(MEMP_NETBUF);
-    if (buf == NULL) {
-      pbuf_free(p);
-      return;
-    } else {
-      buf->p = p;
-      buf->ptr = p;
-      buf->addr = addr;
-      buf->port = port;
-    }
-
-    conn->recv_avail += p->tot_len;
-    /* Register event with callback */
-    if (conn->callback)
-      (*conn->callback)(conn, NETCONN_EVT_RCVPLUS, p->tot_len);
-    sys_mbox_post(conn->recvmbox, buf);
+  buf = memp_malloc(MEMP_NETBUF);
+  if (buf == NULL) {
+    pbuf_free(p);
+    return;
+  } else {
+    buf->p = p;
+    buf->ptr = p;
+    buf->addr = addr;
+    buf->port = port;
   }
+
+  conn->recv_avail += p->tot_len;
+  /* Register event with callback */
+  if (conn->callback)
+    (*conn->callback)(conn, NETCONN_EVT_RCVPLUS, p->tot_len);
+  sys_mbox_post(conn->recvmbox, buf);
 }
 #endif /* LWIP_UDP */
 
@@ -147,24 +143,23 @@ recv_tcp(void *arg, struct tcp_pcb *pcb, struct pbuf *p, err_t err)
 
   conn = arg;
 
-  if (conn == NULL) {
+  if ((conn == NULL) || (conn->recvmbox == SYS_MBOX_NULL)) {
     pbuf_free(p);
     return ERR_VAL;
   }
 
-  if (conn->recvmbox != SYS_MBOX_NULL) {
-    conn->err = err;
-    if (p != NULL) {
-      len = p->tot_len;
-      conn->recv_avail += len;
-    } else {
-      len = 0;
-    }
-    /* Register event with callback */
-    if (conn->callback)
-      (*conn->callback)(conn, NETCONN_EVT_RCVPLUS, len);
-    sys_mbox_post(conn->recvmbox, p);
-  }  
+  conn->err = err;
+  if (p != NULL) {
+    len = p->tot_len;
+    conn->recv_avail += len;
+  } else {
+    len = 0;
+  }
+  /* Register event with callback */
+  if (conn->callback)
+    (*conn->callback)(conn, NETCONN_EVT_RCVPLUS, len);
+  sys_mbox_post(conn->recvmbox, p);
+
   return ERR_OK;
 }